Description

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files, causing the crawler to exfiltrate file contents into the searchable index.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T11:16:41.793Z",
  "pubdate": "2026-08-31T11:16:41.793Z",
  "executiveSummary": "YaCy Search Server through version 1.941 is susceptible to an XML External Entity (XXE) injection vulnerability. This security flaw exists within the application's SVG, FreeMind, and OpenSearch parsers, which fail to explicitly disable external entity resolution during XML processing. The vulnerability allows a remote attacker to craft and publish malicious documents containing Document Type Definition (DTD) declarations with SYSTEM entities.\nBy referencing local system files through these malicious entities, an attacker can coerce the crawler into parsing the document and resolving the external reference. The resulting file content is then processed by the crawler and integrated into the searchable index, effectively exposing sensitive information to unauthorized users. This vulnerability presents a high risk as it facilitates arbitrary local file disclosure (LFD) via the application's core crawling functionality. Successful exploitation does not inherently require high-level privileges, as the crawler typically operates with the permissions of the underlying service account. The impact is significant, as it leads to potential system-wide information leakage and reconnaissance, potentially exposing configuration files, credentials, or sensitive host data to the search index.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure configuration of XML parsers utilized by YaCy Search Server to process SVG, FreeMind, and OpenSearch document types. Specifically, the application utilizes XML parsing libraries that default to permitting external entity substitution when processing DTDs. Because these parsers are not configured with proper security constraints—such as disabling the loading of external DTDs or external parameter entities—the underlying XML processor will attempt to resolve any SYSTEM or PUBLIC identifiers defined within the document's prologue.\nThe attack flow begins when an attacker publishes or submits a malicious file—such as a manipulated SVG or FreeMind document—that includes a doctype declaration. This declaration defines an external entity referencing a sensitive file path on the server's local filesystem (e.g., /etc/passwd or application configuration files). When the YaCy crawler processes this malicious document, the vulnerable parser triggers a request to resolve the specified SYSTEM entity. The XML parser reads the contents of the target file and substitutes the entity reference with the file's data during the parsing process.\nOnce the file contents are extracted and mapped into the document object model (DOM) of the parsed file, the search server indexes the processed document content. Since the crawler's index is typically accessible via the search interface, the attacker can perform subsequent search queries to retrieve the contents of the exfiltrated files directly through the YaCy search front-end. This mechanism effectively bypasses typical file system access controls by leveraging the server's legitimate indexing role.\nThis vulnerability is particularly dangerous because it occurs during the automated ingestion phase of the crawler. No specific user authentication or authorization is required to submit a public document or trigger a crawl of a malicious site, provided the server is configured to index external inputs. The post-exploitation impact includes full or partial retrieval of local files, potential credential harvesting from system files, and deep reconnaissance of the underlying operating system environment, depending on the service account's filesystem permissions. The vulnerability persists across all versions of YaCy up to and including 1.941, representing a persistent risk to any deployment that processes untrusted XML-based metadata formats without proper input sanitization or parser hardening."
}